Are NAS devices (Synology, QNAP, Western Digital) safe right now?
No NAS device flaws have been added to CISA's exploited list in the last 90 days (the most recent was Dec 21, 2023). Keep automatic updates on: that can change any day.
Earlier exploited flaws
- QNAP VioStor NVR OS Command Injection Vulnerability
- QNAP Photo Station Externally Controlled Reference Vulnerability Zero-day
- QNAP Photo Station Path Traversal Vulnerability
- QNAP Photo Station Path Traversal Vulnerability
- QNAP QTS Improper Input Validation Vulnerability
- QNAP Photo Station Improper Access Control Vulnerability
- QNAP NAS File Station Cross-Site Scripting Vulnerability
- QNAP NAS File Station Command Injection Vulnerability
- QNAP NAS File Station Cross-Site Scripting Vulnerability
- QNAP Network-Attached Storage (NAS) Command Injection Vulnerability
- QNAP NAS Improper Authorization Vulnerability
- QNAP Helpdesk Improper Access Control Vulnerability
By year
| Year | Exploited flaws added | Zero-days |
|---|---|---|
| 2026 (so far) | 0 | 0 |
| 2025 | 0 | 0 |
| 2024 | 0 | 0 |
| 2023 | 1 | 0 |
| 2022 | 11 | 1 |
Questions
Are NAS devices (Synology, QNAP, Western Digital) safe right now?
No NAS device flaws have been added to CISA's exploited list in the last 90 days (the most recent was Dec 21, 2023). Keep automatic updates on: that can change any day. Confirm with the vendor's own advisories and install updates as soon as they're available.
How many NAS devices vulnerabilities have been exploited?
12 flaws are on CISA's list of vulnerabilities known to be exploited in real attacks, 9 of them used by ransomware.
Covers products matching synology, qnap, western digital, wd my cloud, asustor. Sources: CISA's Known Exploited Vulnerabilities catalog and the vendors' own advisories. Updated every hour. General information only; confirm details with the vendor.